CVE-2023-29186
📋 TL;DR
This vulnerability allows attackers with administrative privileges to exploit a directory traversal flaw in SAP NetWeaver BI CONT ADDON reports to upload and overwrite files on the SAP server. While data cannot be read, critical OS files can be overwritten, potentially making the system unavailable. Affected systems include SAP NetWeaver (BI CONT ADDON) versions 707, 737, 747, and 757.
💻 Affected Systems
- SAP NetWeaver BI CONT ADDON
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability through overwriting critical OS files, leading to denial of service and potential data loss.
Likely Case
System disruption or downtime through file overwriting attacks by privileged attackers.
If Mitigated
Limited impact if proper access controls and file system permissions are enforced.
🎯 Exploit Status
Exploitation requires administrative privileges; directory traversal techniques are well-understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3305907
Vendor Advisory: https://launchpad.support.sap.com/#/notes/3305907
Restart Required: Yes
Instructions:
1. Download SAP Note 3305907 from SAP Support Portal. 2. Apply the correction instructions provided in the note. 3. Restart affected SAP services. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Restrict Report Access
allLimit access to vulnerable report functionality to only necessary users.
Configure SAP authorization profiles to restrict report execution
File System Permissions
linuxSet restrictive permissions on OS directories to prevent file overwriting.
chmod 750 /usr/sap/
chown sapadmin:sapsys /usr/sap/
🧯 If You Can't Patch
- Implement strict access controls to limit administrative privileges
- Monitor file system changes and implement file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check SAP system version and verify if SAP Note 3305907 is applied using transaction SNOTE.Check Version:
Execute SAP transaction SM51 to check system version and patch level.Verify Fix Applied:
Verify SAP Note 3305907 implementation status and test report functionality for directory traversal.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload activities in SAP logs
- Failed directory traversal attempts in system logs
Network Indicators:
- HTTP requests with directory traversal patterns to report endpoints
SIEM Query:
source="sap_logs" AND ("directory traversal" OR "../" OR "..\")